VDB
CVE-2007-2524
CVE-2007-2524
PUBLISHED
CVSS 4.300000190734863 MEDIUM
Cross-site scripting (XSS) vulnerability in index.pl in Open Ticket Request System (OTRS) 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action. NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, but the proper identifier for the ipsec-tools issue is CVE-2007-1841.
EPSS 4.54% · 91.5th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
4.54%
91.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| otrs | otrs | 2.0.4 |
Timeline
- May 8, 2007 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Oct 28, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 5, 2023 EPSS Score
- Jul 20, 2023 EPSS Score
- Sep 11, 2023 EPSS Score
- Nov 3, 2023 EPSS Score
References
- http://www.virtuax.be/?page=library&id=35&type=Exploits url
- otrs-indexpl-xss(34164) vdb
- SUSE-SR:2007:013 vendor-advisory
- 20070507 OTRS <= 2.0.x XSS/XSRF mailing-list
- 35821 vdb
- ADV-2007-1698 vdb
- 20070611 Re: [SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial ofservice mailing-list
- 23862 vdb
- 25205 third-party-advisory
- 35822 vdb
- DSA-1298 vendor-advisory
- 2668 third-party-advisory
- 25787 third-party-advisory
- 25419 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2007-2524 advisory